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Abstract: Self-stabilization is a general paradigm to provide forward recovery 
capabilities to distributed systems and networks. Intuitively, a protocol is self- 
stabilizing if it is able to recover without external intervention from any catastrophic 
transient failure. 

In this paper, our focus is to lower the communication complexity of self-stabilizing 
protocols below the need of checking every neighbor forever. In more details, the con- 
tribution of the paper is threefold: (i) We provide new complexity measures for com- 
munication efficiency of self-stabilizing protocols, especially in the stabilized phase 
or when there are no faults, (ii) On the negative side, we show that for non-trivial 
problems such as coloring, maximal matching, and maximal independent set, it is 
impossible to get (deterministic or probabilistic) self-stabilizing solutions where ev- 
ery participant communicates with less than every neighbor in the stabilized phase, 
and (in) On the positive side, we present protocols for coloring, maximal matching, 
and maximal independent set such that a fraction of the participants communicates 
with exactly one neighbor in the stabilized phase. 

Key-words: self-stabilization, lower bounds, communication complexity, coloring, 
maximal matching, maximal independent set 
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EfRcacite des Communications des les Protocoles 
Auto-stabilisants Silencieux 



Resume : L'auto-stabilisation est un paradigme general pour assurer la reprise sur 
erreur dans les reseaux et les systemes distribues. Un algorithme reparti est auto- 
stabilisant si, apres que des fautes et des attaques aient frappe le systeme et I'aient 
place dans un etat quelconque, le systeme corrige cette situation catastrophique sans 
intervention exterieure en temps fini. 

Dans cet article, nous nous concentrons sur la complexite des communications 
des algorithmes auto-stabilisants au dela du besoin de verifier infiment souvent tons 
les voisins de chaque processus. La contribution de Particle pent etre resumee en 
trois points principaux: (i) nous proposons de nouvelles mesures de complexite 
pour les communications des protocoles auto-stabilisants, e particulier dans la phase 
stabilisee ou quand il n'y a pas de fautes ] (ii) nous montrons que pour des problemes 
non-triviaux tels que le coloriage, le mariage maximal, et I'ensemble maximal in- 
dependant, il est impossible d'obtenir des solutions (deterministes ou probabilistes) 
auto-stabilisantes ou chaque participant communique avec moins que tons ses voisins 
dans la phase stabilisee ; (in) nous presentons des protocoles pour le coloriage, 
le mariage maximal, et I'ensemble maximal independant tels qu'une fraction des 
participants communique avec exactement un voisin lors de la phase stabilisee. 

Mots-cles : auto-stabilisation, bornes inferieures, complexite des communications, 
coloriage, mariage maximal, ensemble maximal independant 
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1 Introduction 

Self-stabilization [8] is a general paradigm to provide forward recovery capabilities 
to distributed systems and networks. Intuitively, a protocol is self-stabilizing if it is 
able to recover without external intervention from any catastrophic transient failure. 
Among the many self-stabilizing solutions available today [9], the most useful ones 
for real networks are those that admit efficient implementations. 

Most of the literature is dedicated to improving efficiency after failures occur, 
ie., minimizing the stabilization time - the maximum amount of time one has to wait 
before failure recovery. While this metric is meaningful to evaluate the efficiency 
in the presence of failures, it fails at capturing the overhead of self-stabilization 
when there are no faults, or after stabilization. In order to take forward recovery 
actions in case of failures, a self-stabilizing protocol has to gather information from 
other nodes in order to detect inconsistencies. Of course, a global communication 
mechanism will lead to a large coverage of anomaly detection [T5] at the expense of 
an extremely expensive solution when there are no faults, since information about 
every participant has to be repetitively sent to every other participant. As pointed 
out in [5j, the amount of information that has to be gatherered highly depends on 
the task to be solved if only the output of the protocol is to be used for such anomaly 
detection. The paper also points out that more efficient schemes could be available 
for some particular implementations. However, to the best of our knowledge, the 
minimal amount of communicated information in self-stabilizing systems is still fully 
local [3l[H[5]: when there are no faults, every participant has to communicate with 
every other neighbor repetitively. 

In this paper, our focus is to lower the communication complexity of self-stabilizing 
protocols below the need of checking every neighbor. A quick observation shows that 
non-existent communication is impossible in the context of self-stabilization: the 
initial configuration of the network could be such that the specification is violated 
while no participant is sending nor getting neighboring information, resulting in a 
deadlock. On the other side, there exist problems (such as coloring, maximal match- 
ing, maximal independent set) that admit solutions where participants only have to 
communicate with their full set of neighbors. We investigate the possibility of in- 
termediate solutions {i.e. where participants communicate repetitively only with a 
strict subset of their neighbors) that would lead to more efficient implementations 
in stabilized phase or when there are no faults. Good candidates for admitting such 
interesting complexity solutions are silent protocols |10j: a silent protocol is a self- 
stabilizing protocol that exhibits the additionnal property that after stabilization, 
communication is fixed between neighbors (that is, neighbors repetitively commu- 
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nicate the same information for every neighbor forever). We thus concentrate on 
lowering communication complexity requirements for silent self-stabilizing protocols. 
In more details, the contribution of the paper is threefold: 

1. We provide new complexity measures for communication efficiency of self- 
stabilizing protocols, especially in the stabilized phase or when there are no 
faults. Our notion of communication efficiency differs from the one introduced 
in [16j (that was subsequently used for fault-tolerant non-self-stabilizing sys- 
tems [ini [U E] and then extented to fault-tolerant self-stabilizing systems - 
a.k.a. ftss - [7]). The essential difference is that the efficiency criterium of [16] 
is global (eventually only n — 1 communication channels are used) while our 
notion is local (eventually processes only commnunicate with a strict subset 
of their neighbors). As noted in [El [TJ [21 [7] , global communication efficiency 
often leads to solutions where one process needs to periodically send messages 
to every other process. In contrast, with our notion, the communication load 
is entirely distributed and balanced. 

2. On the negative side, we show two impossibility results holding for a wide 
class of problems. This class includes many classical distributed problems, 
e.g.^ coloring [12], maximal matching [17j, and maximal independent set [13j. 
We first show that there is no (deterministic or probabilistic) self-stabilizing 
solutions for such problems in arbitrary anonymous network where every par- 
ticipant has communicate with a strict subset of its neighbors once the system 
is stabilized. We then show that it is even more difficult to self- stabilize these 
problems if the communication constraint must always hold. Indeed, even with 
symmetry-breaking mechanisms such as a leader or acyclic orientation of the 
network, those tasks remain impossible to solve. 

3. On the positive side, we present protocols for coloring, maximal matching, and 
maximal independent set such that a fraction of the participants communicates 
with exactly one neighbor in the stabilized phase. 

The remaining of the paper is organized as follows. Section [2] presents the com- 
putational model we use throughout the paper. We introduce in Section [3] new 
complexity measures for communication efficiency of self-stabilizing protocols. Sec- 
tions [4] and [5] describe our negative and positive results, respectively. Section [6] 
provides some concluding remarks and open questions. 
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2 Model 

A distributed system is a set E of n communicating state machines called processes. 
Each process p can directly communicate using bidirectional media with a restricted 
subset of processes called neighbors. We denote by T.p the set of p's neighbors and 
by 6.p the degree of i.e., the size of T.p. We consider here distributed systems 
having an arbitrary connected topology, modelized by an undirected connected graph 
G = (n, E) where £' is a set of m edges representing the bidirectional media between 
neighboring processes. In the sequel, A denotes the degree of G and D its diameter. 

We assume that each process p can distinguish any two neighbors using local 
indices, that are numbered from 1 to 6.p. In the following, we will indifferently 
use the label q to designate the process q or the local index of q in the code of 
some process p. We will often use the anonymous assumption which states that the 
processes may only differ by their degrees. 

Communications are carried out using a finite number of communication vari- 
ables that are maintained by each process. Communication variables maintained 
by process p can be read and written by p, but only read by p's neighbors. Each 
process p also maintains a finite set of internal variables that may only be accessed 
by p. Each variable ranges over a fixed domain of values. We use uppercase letters 
to denote communication variables and lowercase ones to denote internal variables. 
Some variables can be constant, that is, they have a determined fixed value. In 
the following, we will refer to a variable v of the process p as v.p. The state of a 
process is defined by the values of its (communication and internal) variables. A 
configuration is an instance of the states of all processes. The communication state 
of a process is its state restricted to its communication variables. A communication 
configuration is an instance of the communication states of all processes. 

A protocol is a collection of n sequential local algorithms, each process executing 
one local algorithm. A process updates its state by executing its local algorithm. 
A local algorithm consists of a finite set of guarded actions of the form (guard) 
(action). A guard is a Boolean predicate over the (communication and internal) 
variables of the process and the communication variables of its neighbors. An action 
is a sequence of statements assigning new values to its (communication and internal) 
variables. An action can be executed only if its guard is true. We assume that the 
execution of any action is atomic. An action is said enabled in some configuration if 
its guard is true in this configuration. By extention, we say that a process is enabled 
if at least one of its actions is enabled. 

A computation is an infinite sequence (7o<5o7i), (715172), ... (7z5^7^+i), .. . such 
that for any i > 0: (^i^ 7^ is a configuration, (ii) Siis di non-empty subset of processes 
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chosen according to a scheduler (defined below), and (in) each configuration 7^+1 
is obtained from 7^ after ah processes in Si execute from 7^_i one of their enabled 
actions, if any0 Any triplet (7^5^7^+i) is called a step. Any finite sequence of 
consecutive steps of C starting from 70 is a prefix of C. A suffix of C is any 
computation obtained by removing a finite sequence (7o5o7i), • • • , (ikSklk+i) from 
C. The suffix associated to the prefix (7o«so7i) • • • , (72-15^-17^) is the suffix of C 
starting from 7^. A configuration 7' is said reachable from the configuration 7 if and 
only if there exists a computation starting from 7 that contains the configuration 

A scheduler is a predicate on computations that determines which are the possible 
computations. In this paper, we assume a distributed fair scheduler. Distributed 
means that any non-empty subset of processes can be chosen in each step to execute 
an action. Fair means that every process is selected infinitely many times to execute 
an action. We assume priority on the guarded actions that are induced by the order 
of appearance of the actions in the code of the protocols. Actions appearing first 
have higher priority than those appearing last. 

To compute the time complexity, we use the notion of round [llj. This notion 
captures the execution rate of the slowest process in any computation. The first 
round of an computation C, noted C\ is the minimal prefix of C where every 
process has been activated by the scheduler. Let C be the suffix associated to C^ 
The second round of C is the first round of C^^, and so on. 

2.1 Self-stabilization 

We now formally define the notions of deterministic self- stabilization [8\ (simply 
referred to as self-stabilization) and probabilistic self- stabilization [Hj. 

A configuration conforms to a predicate if this predicate is satisfied in this config- 
uration; otherwise the configuration violates the predicate. By this definition every 
configuration conforms to the predicate true and none conforms to the predicate 
false. Let R and S be predicates on configurations of the protocol. Predicate R is 
closed with respect to the protocol actions if every configuration of any computa- 
tion that starts in a configuration conforming to R also conforms to R. Predicate 
R converges to S if R and S are closed and every computation starting from a 
configuration conforming to R contains a configuration conforming to S. 

Definition 1 (Deterministic Self-Stabilization) A protocol deterministically sta- 
bilizes to a predicate R if and only if true converges to R. 

^If all processes in Si are disabled in 7^, then 7^+1 = 7^ 
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Definition 2 (Probabilistic Self-Stabilization) A protocol probabilistically sta- 
bilizes to a predicate R if and only if true converges to R with probability 1. 

In any protocol that stabilizes to the predicate i?, any configuration that con- 
forms to R is said legitimate. Conversely, any configuration that violates R is said 
illegitimate. 

2.2 Silence 

All protocols presented in this paper are silent. The notion of silent protocol has 
been defined in [10] as follows: 

Definition 3 (Silent Protocol) An protocol is silent if and only if starting from 
any configuration, it converges to a configuration after which the values of its com- 
munication variables are fixed. 

In the remaining of the paper, we will call silent configuration any configuration 
from which the values of all communication variables are fixed. 

3 New Measures for Communication Efficiency 

3.1 Communication Efficiency 

In this paper, we are interested in designing self-stabilizing protocols where processes 
do not communicate with all their neighbors during each step. The 'k- efficiency 
defined below allows to compare protocols following this criterium. 

Definition 4 (k-efficient) A protocol is said to be ^-efficient if in every step of 
its possible computations, every process reads communication variables of at most k 
neighbors. 

Note that in this paper, we only present l-ejQ^czent protocol. Note also that every 
distributed self-stabilizing protocol is trivially /\- efficient. 

3.2 Space complexity 

To be able to compare the space complexity of distributed algorihtms, we distinguish 
two complexity criteria. 

Definition 5 (Communication Complexity) The communication complexity of 
a process p is the maximal amount of memory p reads from its neighbors in any given 
step. 
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Example: In our coloring protocol (Figure [71 page [16]), in any step a process only 
reads the color ( A + 1 states) of a single neighbor, so in this protocol the communi- 
cation complexity is log(A + 1) bits per process. By contrast, a traditional coloring 
protocol that reads the state of every neighbor at each step has communication 
complexity Alog(A + 1). 

Definition 6 (Space complexity) The space complexity of a process p is the sum 
of the local memory space (that is, the space needed for communication and internal 
variables) and the communication complexity of p. 

Example: In our coloring protocol (Figure [71 page [16]), the communication com- 
plexity is log(A + 1) bits per process and the local memory space of any process 
p is log(A + 1) + log{S.p) bits (log(A + 1) for the C-variable and log{S.p) for the 
ci/r-variable) . So a process p has a space complexity of 21og(A + 1) + log{S.p) bits. 

3.3 Communication Stability 

In our protocols, some processes may read the communication variables of every 
neighbor forever, while other processes may eventually read the communication vari- 
able of a single neighbor. We emphasize this behavior by introducing the k-stability 
and two weakened forms: the stability and the ()-{^^'^) -stability. 

Let C = (to-^oTi), • • • (7i-i5i-i7i), ... be a computation. Let Rp{C) be the set of 
neighbors from which p reads some communication variables in step (7i5^7^+i). Let 
Rp(C) = \R^p(C) U . . . U Ri(C) U . . . |. 

Definition 7 (k-Stable) A protocol is k-stable if in every computation C , every 
process p satisfies Rp(C) < k. 

Observe that every protocol is /S.- stable. Note also that any ^-stable protocol is 
also efficient but efficient protocols are not necessarily k-stable. 

Definition 8 (O-k-Stable) A protocol is 0-k-stable if in every computation C, 
there is a suffix such that every process p satisfies Rp{C^) < k. 

Definition 9 (0-(x,k)-Stable) A protocol is 0-(x, k)-stable if in every computa- 
tion C, there are a subset S of x processes and a suffix C such that every process 
p ^ S satisfies Rp{C') < k. 

Similary to ()-{x^'k.) -stable^ one could define the notion of (x^k) -stable. However, 
we do not consider such a property here. Note also that the notions of () -k-stable 
and ()-{n,k) -stable are equivalent. 
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4 Impossibility Results 

We now provide a general condition on the output of communication variables that 
prevents the existence of some communication stable solutions. Informally, if the 
communication variables of two neighboring processes p and q can be in two states 
ap and aq that are legitimate separately but not simultaneously, there exists no 
0-fc-stable solution for A: < A. This condition, that we refer to by the notion of 
neighbor- completeness is actually satisfied by every silent self-stabilizing solution to 
the problems we consider in the paper: vertex coloring, maximal independent set, 
maximal matching. 

Definition 10 (neighbor-completeness) protoco/ A Z5 sazrf neighbor-complete 
for predicate P if and only if A is silent, self- stabilizes to P, and for every process 
p, there exists a communication state of p, say ap, such that: 

1. There exists a silent configuration where the communication state of p is a^. 

2. For every neighbor of p, say q, there exists a communication state of q, say 
aq, such that: 

(a) Every configuration where the communication state of p is and the 
communication state of q is aq violates P. 

(b) There exists a silent configuration where the communication state of q is 
aq. 

Theorem 1 There is no 0-k-stable (even probabilistic) neighbor-complete protocol 
working in arbitrary anonymous networks of degree A > k. 

Proof. Assume, by the contradiction, that there exists an stable protocol 
that is (deterministically or probabilistically) neighbor- complete for a predicate P in 
any anonymous network of degree A > k. 

To show the contradiction, we prove that for any A > 0, there exist topologies 
of degree A for which there is no ()-'k-stable protocol that is neighbor- complete for 
P with k = A — 1. This result implies the contradiction for any k < A. 

We first consider the case A = 2. (The case A = 1 can be easily deduce using a 
network of two processes and following the same construction as the one for A = 2.) 
We will then explain how to generalize the case A = 2 for any A > 2. 

Case A = 2 and k = A — 1; Consider an anonymous chain of five processes pi, 
P2i Ps^ Pa^ and p^. (In the following. Figured] may help the reader.) 

By Definition, there exists a communication state of 7)3, say 0^3 such that: 
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(a) 




(b) 

pi' p2' p3' p4' p5' pe' py' 



(c) 



pi' p2' p3' p4' p5 



(d) 



Figure 1: Construction of illegitimate silent configurations in Theorem [T] (The black 
crosses indicate that the communication variable of a process is not read by a neigh- 
bor) 



1. There exists a silent configuration 73 where the communication state of ps is 
0^3. 

2. For every neighbor of ^3, pi {i G {2, 4}), there exists a communication state of 
Pi^ say ai^ such that: 

(a) Any configuration where the communication state of p3 is 0^3 and the 
communication state of pi is ai violates P. 

(b) There exists a silent configuration 7^ where the communication state of 
Pi is ai. 

From the configuration 73, the system eventually reaches a silent configuration 
73 from which p3 stops to read the communication variables of one neighbor because 
the degree of p'^ is equal to A. Without loss of generality, assume that this neighbor 
is p4. (As in the configuration (a) in Figure [H) As 73 is silent, the communication 
state of p in 73 is the same as in 73: 0^3. 

Similary, from 74 (7^ with i = 4), the system eventually reaches a silent configu- 
ration 74 from which ^4 stops to read the communication variables of one neighbor 
Pj G {3,5} and where the communication state of ^4 is 0^4. 
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Consider the two following cases: 

• Pj — P5- (As in the configuration (b) in Figured]). Consider a new network of 
seven processes: p[, . . . , p^. Assume the following initial configuration 7: Any 
process p[ with i G {1,2,3} has the same state as pi in 73, ^4 has the state 
of p4 in 74, has the state of ps in 74, p^ has the state of p2 in 74, and p^ 
has the state of pi in 74. (This configuration corresponds to the configuration 
(c) of Figure [H) We can then remark that ^3 is in the same situation that ps 
in the configuration 73, so ^3 does not read the communication variables of 
P4. Similary, ^4 does not read the communication variables of p^^. Moreover, 
no process modifies the content of its communication variable, otherwise they 
can do the same in 73 or 74 and this contradicts the fact that 73 and 74 are 
silent. Hence, 7 is silent and, as ^3 and ^4 have the same communication state 
in 7 as ps in 73 and p4 in 74, 7 violates P. Thus, any computation starting 
from 7 never converges to a configuration satisfying P, i.e., protocol A is not 
self-stabilizing for P, a contradiction. 

• Pj — Ps- This case is similar to the previous one: By constructing a configura- 
tion such as the configuration (d) in Figure [H we also obtain a contradiction. 



Figure 2: Generalization for A = 3, Theorem [T] 

The previous proof can be generalizated for k = A — 1 and A > 2 using a graph of 
A^ + 1 nodes where there is a node of degree A (the role of this node is the same 
as node ps in the case k = A — 1 and A = 2) that is linked to A nodes of degree A. 
Each of these last A nodes being hnked to A — 1 pendent nodes. Figure [2] depicts 
the generalization for A = 3. 

□ 
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In the next section, we will show that assuming a colored arbitrary network, it is 
possible to design ()-(x^l)- stable neighbor- complete protocols. Actually, we use the 
local coloring because it allows to deduce a dag- orientation in the network (defined 
below). Theorem [2] shows that even assuming a rooted and/or dag- oriented network, 
it is impossible to design k-stable neighbor- complete protocols for k < A. 

Definition 11 (Dag-orientation) LetS.p be the set of possible states of process p. 
We say that a system is dag-oriented iff for every process p, there exists a function 
fp : S.p 1-^ 2^-^ and a subset Succ.p C T.p such that: 

• \/ap G S.p, fp(ap) = Succ.p, and 

• The directed subgraph G' — {J1,E') where E' — {(p^q)^p G 11 A g G Succ.p} is 
a dagH 

Theorem 2 Let k < A. There is no k-stable (even probabilistic) neighbor-complete 
protocol in any arbitrary rooted and dag- oriented network. 

Proof. Assume, by the contradiction, that there exists a k-stable protocol that 
is (deterministically or probabilistically) neighbor- complete for a predicate P in any 
arbitrary rooted and dag-oriented network. 

To show the contradiction, we prove that for any A > 0, there exists rooted 
and dag-oriented topologies of degree A where there is no k-stable protocol that is 
neighbor- complete for P with k = A — 1. This result implies the contradiction for 
any k < A. 

To that goal, we first consider the case A = 2 (the case A = 1 is trivial because, 
in this case, k = and in any -stable protocol, no process can communicate with 
each other). We will then explain how to generalize the case A = 2 for any A > 2. 

Case A = 2 and k = A — 1.- Consider the rooted dag-oriented network presented 
in Figure [3l In this figure, the dag-orientation is given by the arrows and the root 
is the process represented as a bold circle (that is, process pi). 

Let us consider process p2- By Definition, there exists a communication state of 
P2, say a2 such that: 

1. There exists a silent configuration 72 where the communication state of p2 is 

2. For every neighbor of p2, say pi {i G {1,5}), there exists a communication 
state of Pi, say o;^, such that: 

^Directed Acyclic Graph 
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(a) Any configuration where the communication state of p2 is 0^2 and the 
communication state of pi is ai violates P. 

(b) There exists a silent configuration 7^ where the communication state of 
Pi is ai. 

Consider the silent configuration 72. The degree of process p2 is A so, from 72, P2 
never reads the communication variable of one of its neighbor: pi or p^. So, let us 
consider these two cases: 

1. From 72; P2 does not read the communication variables of p^. Consider the 
process pq in 72. By definition, since pq reads the communication variables of 
one of its neighbors, pq cannot read the one of the other neighbor forever. So, 
Pq decides which process it never read only using its state in 72. Moreover, it 
cannot use the orientation to take its decision because the orientation is the 
same of each of its two neighbors. Depending only on its state, p^ will decide 
to read the communication variable of its neighbor having the channel number 
i G {1,2}. Now there exists a possible network where ^4 is the neighbor i 
in the local order of pq. Hence, we can have a configuration 72 similar to 
the configuration (a) of Figure [H a silent configuration from which p2 never 
reads the communication variables of p^ and pq never reads the communication 
variables of ^4. 

Using a similar reasonning, we can have a silent configuration 75 from which 
P5 never reads the communication variables of p2 and p4 never reads the com- 
munication variables of pe- configuration (b) of Figure [H 

Consider now the configuration (c) of Figure [H In this configuration: (1) 
Pi 5 P25 P?>i and Pq have the same states, the same channel labelling, and so 
the same local views of their neighbors as in 72, and (2) ^4 and p^ have the 
same states, the same channel labelling, and so the same local views of their 
neighbors as in 75. So, configuration (c) is silent (otherwise this means that 
72 or 75 are not silent). But, as the communication states of p2 and p^ are 
respectively a2 and 0^5, configuration (c) violates P. Hence, any computation 
starting from configuration (c) never converges to a legitimate configuration, 
ie., A is not self-stabilizing for P, a contradiction. 

2. From 72; P2 does not read the communication variables of pi. Similary to the 
previous case, we can also obtain a contradiction by constructing an illegiti- 
mate silent configuration such as the one shown in Figure [5] (c). 
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Figure 3: Network considered in Theorem [2] 




( ( 

Figure 4: First case of Theorem [2] 



The previous proof can be generahzed for k = A — 1 and A > 2 by considering 
a topology where A — 2 pendent nodes are added to each process of the network in 
Figure El {n.b, the arrowes must be oriented in such way that (1) pi and p4 remain 
sources and (2) andpe remain sink.) Figure E] depicts the generahzation for A = 3. 
□ 

5 Protocols 

5.1 Vertex Coloring 

In the vertex coloring problem, each process p computes a local function color.p. 
The function color.p outputs a value called color of p. The vertex coloring predicate 
is true if and only if for every process p and every p's neighbor color.p ^ color. q. In 
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Figure 5: Second case of Theorem [2] 




Figure 6: Generalization for A = 3, Theorem [2] 
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any self-stabilizing vertex coloring protocol, the legitimate configurations are those 
satisfying the vertex coloring predicate. 

Communication Variable: 
C.pG {1...A + 1} 

Internal Variable: 

cur.p G [1 . . . 6.p] 

Actions: 

(C.p = C. (cur.p)) C.p ^ random({l . . . A + 1}); cur.p ^ (cur.p mod S.p) + 1 

(C.p ^ C. (cur.p)) cur.p ^ (cur.p mod S.p) + 1 

Figure 7: Protocol COCOTZXAfQ for any process p 

We propose in Figure [71 a 1- efficient protocol that stabilizes to the vertex col- 
oring predicate with probability 1. In the following, we refer to this protocol as 
Protocol COCOniMQ. Protocol COCOTZlNQ is designed for arbitrary anony- 
mous networks. In Protocol COCOTZXMQ^ the function color.p just consists in 
outputting the value of the communication variable C.p. This variable takes a value 
in{l...A + l}, A+1 being the minimal number of colors required to solve the 
problem in any arbitrary network (indeed, the protocol must operate even if the net- 
work contains a A-clique). The legitimate configurations of Protocol COCOTZXMQ 
{w.r.t. the vertex coloring predicate) are the thoses satisfying: for every process p 
and every j)'s neighbor C.p ^ C.q. 

In Protocol COCOTZXAfQ^ each process checks one by one the color of its neigh- 
bors in a round robin manner. The current checked neighbor is the neighbor pointed 
out by the internal variable cur. If a process detects that its color is identical to the 
one of the neighbor it is checking, then it chooses a new color by random in the set 
{1 . . . A + 1}. Below, we show the correctness of Protocol COCOTZXMQ. 

The following lemma is trivial because a process can change its color only if it 
has the same color as the neighbor it checks. 

Lemma 1 The vertex coloring predicate is closed in any computation of COCOTZXMQ . 

Lemma 2 Starting from an arbitrary configuration, any computation of COCOTZXMQ 
reaches a configuration satisfying the vertex coloring predicate with probability 1. 

Proof. Let Conflit{'y) be the number of processes p having a neighbor q such 
that C.p = in 7. 

Assume, by the contradiction, that there exists a configuration from which the 
probability to reach a legitimate configuration (i.e., a configuration satisfying the 
vertex coloring predicate) is strictly less than 1. 
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The number of configurations is finite because any variable in the code of COCOTZXMQ 
ranges over a fix domain and the number of processes (n) is finite. So, there exists 
a subset of illegitimate configurations S satisfying: V7 G 5, the probability to reach 
from 7 a configuration 7^ such that Conflit{^') < Conflit{j) is 0. 

Consider a configuration 7 in S. From 7, every process executes actions infinitely 
often because the scheduler is fair and every process is always enabled. Let be 
the subset of processes p such that 3q G F.p, C.p = C.q in 7. Some processes of 
Pj eventually choose a new color by random in {1 ... A + 1}. Let P^ C P^ be the 
processes that are chosen first by the scheduler to change their color. The probability 
to reach a configuration 7' such that Conflit{y) < Conflit('y) when the processes 
of P^ change their color is strictly positive because there is at least one combination 
of new colors such that G P^, G F.p, C.p ^ C.q in 7^ Hence, the probability 
to reach from 7 a configuration 7^ such that Conflit{'-)') < Conflit{'y) is different 
of 0, a contradiction. □ 

By Lemmas [H [2l Protocol COCOTZXMQ converges from any configuration to the 
vertex coloring predicate with probability 1. Moreover, COCOTZIMQ is 1- efficient 
because when a process p executes an action in COCOTZXMQ^ it only reads the color 
of its neighbor pointed out by cur.p. Hence, follows: 

Theorem 3 Protocol CO COTZXNQ (Figure^ is a 1- efficient protocol that stabilizes 
to the vertex coloring predicate with probability 1 in any anonymous network. 

5.2 Maximal Independent Set 

We now consider the maximal independent set (MIS) problem. An independent set 
of the network is a subset of processes such that no two distinct processes of this set 
are neighbors. An independent set S is said maximal if no proper superset of S is 
an independent set. 

In the maximal independent set problem, each process p computes a local Boolean 
function inMIS.p that decides if p is in the maximal independent set. The MIS 
predicate is true if and only if the subset {q G H, inMIS.q] is a maximal independent 
set of the network. In any self-stabilizing MIS protocol, the legitimate configurations 
are those satisfying the MIS predicate. 

We propose in Figure [8] a l-ejQ^czent protocol that stabilizes to the MIS predicate. 
In the following, we refer to this protocol as Protocol MTS. In [13], authors propose 
a self-stabilizing MIS protocol working in arbitrary networks assuming that processes 
have global identifiers that can be ordered. Here, the proposed protocol works in 
arbitrary networks too, but assuming that (1) each process p holds a local identifier 
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Communication Variable: 

S.p G {Dominator , dominated} 

Communication Constant: 

C.p: color 

Internal Variable: 

cur.p G [1 . . . S.p] 

Actions: 

(S. (cur.p) = Dominator A C. {cur.p) -< C.p A S.p = Dominator) S.p ^ dominated 

[(S. (cur.p) = dominated V C.p -< C. (cur.p)) A (S.p = dominated)] S.p ^ Dominator; cur.p ^ (cur.p mod S.p) + 1 

(S.p = Dominator) cur.p ^ (cur.p mod S.p) + 1 

Figure 8: Protocol MXS for any process p 



C.p (i.e., a "color" that is unique in the neighbourhood) and (2) the local identifiers 
are ordered following the relation Using such colors is very usefuU because it 
gives a DAG-orientation of the network, as shown below: 

Theorem 4 Let E' he the set of oriented edges such that (^, q) G E' if and only if 
p and q are neighbors and C.p -< C.q. The oriented graph C = (H, E') is a directed 
acyclic graph ( dag^. 

Proof. Assume, by the contradiction, that there is a cycle po . . .pk in G\ Then, 
there is an oriented edge {pk^Po) which means that: (1) po and pk are neighbors 
and (2) C.pk C.po. Now, Vz G [0...A; — 1], C.pi C.pi-^i. So, by transitivity, 
C.po C.pk and this contradicts (2). □ 

In Protocol AiXS^ any process p maintains the communication variable S.p that has 
two possible states: Dominator or dominated. S.p states if p is in the indepen- 
dent set (Dominator) or not (dominated). Hence, in Protocol MTS^ the function 
inMI S.p ]Mst consists in testing if S.p = Dominator. The legitimate configurations 
of Protocol AiTS are those satisfying: 

1. Vp G n, (S.p = Dominator) ^ (Wq G F.p, S.q = dominated). 

2. \/p G n, (S.p = dominated) ^ (3q G F.p, S.q = Dominator). 

The first condition states that the set of Dominator s is an independent set, while 
the second condition states that the independent set is maximal. 

We now outline the principles of Protocol M.IS. First, we use the internal 
variable, cur^ to get the communication efficiency: a process p can only read the 
communication state of the neighbor pointed out by cur.p. Then, depending of S.p^ 
each process p adopts the following strategy: 
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• If S.p — Dominator, then p checks one by one (in a round robin manner) the 
communication states of its neighbors until it points out a neighbor q that 
is also a Dominator. In such a case, either p or q must become dominated 
to satisfy Condition 1. We then use the colors to make a deterministic choice 
between p and q. That is, the one having the greatest color (w.r.t. ^) becomes 
dominated. Note that in a legitimate configuration, every Dominator process 
continues to check its neighbors all the time. 

• If S.p = dominated, then p must have the guarantee that one of its neighbor 
is a Dominator. Hence, p switches S.p from dominated to Dominator if 
the neighbor it points out with cur.p is not a Dominator {i.e., S.{cur.p) = 
dominated). Also, to have a faster convergence time, p switches S.p from 
dominated to Dominator if the neighbor it points out with cur.p has a greater 
color (even if it is a Dominator). 

We now show the correctness of Protocol MIS (Theorem [5j) . We then show in 
Theorem El that Protocol MIS is 0-( [ ^""^^-^ J , l)-gta6/e where Cmax is the length 
(number of edges) of the longest elementary path in the network. 

We show that Protocol MIS stabilizes to the MIS predicate in two steps: (1) We 
first show that any silent configuration of Protocol MIS satisfies the MIS predicate. 
(2) We then show that Protocol MIS reaches a silent configuration starting from 
any configuration in O(AtJC) rounds where jJC is the number of colors used in the 
network. 

Lemma 3 Any silent configuration of Protocol MIS satisfies the MIS predicate. 

Proof. The silent configurations of Protocol MIS are those from which all the S 
variables are fixed (remember that S is the only communication variable of Protocol 
MIS). 

So, in such a configuration 7, any Dominator (i.e. any process satisfying S = 
Dominator) has no neighbor that is also a Dominator, otherwise at least one of 
the Dominator process eventually becomes a dominated process {i.e., a process 
satisfying S = dominated) following the first action of the protocol. Hence, the set 
of Dominator processes in 7 is an independent set. 

Moreover, any dominated process has a Dominator as neighbor in 7. Actually 
the neighbor pointed out by the c^xr-pointer is a Dominator. Hence the independent 
set in 7 is maximal. □ 

Notation 1 In the following, we use these notations: 
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• CSET = {C.p,peU}, 

• = \CSET\, and 

• Vc G CSET, n{c) = \W e CSET.c' ^ c}|. 

Lemma 4 Starting from any configuration, any computation of Protocol MXS reaches 
a silent configuration in at most A x jJC rounds. 

Proof. To show this lemma we prove the fohowing induction: Vj> G H, TZ{C.p) — z, 
the variable S.p (the only communication variable) is fixed after at most A x (z + 1) 
rounds. The lemma will be then deduced by the fact that: Vc G CSET^ < 7^(c) < 

Case i = 0. Let p be a process such that TZ{p) — (such a process exists by 
Lemma H]). If S.p — Dominator in the initial configuration, then S.p remains equal 
to Dominator forever because G F.p, C.p C.q. If S.p = dominated in the 
initial configuration, then the neighbor q pointed out by cur.p satisfies C.p ^ C.q. 
So, p is enabled to switch S.p to Dominator. Thus, p switches S.p to Dominator 
in at most one round and then S.p remains equal to Dominator forever (as in the 
previous case). Hence, any process p such that 7l{p) = satisfies S.p = Dominator 
forever in at most one round and the induction holds for z = 0. 

Induction assumption: Assume that there exists A:,0<A:<ttC — 1 such that for 
every process p such that 7l{p) = the variable S.p is fixed in at most A x (A: + 1) 
rounds. 

Case z = /c + 1. Let p be a process such that 7l{p) = /c + 1. After A x (A: + 1) 
rounds, the 5- variable of any p's neighbor q such that C.q ^ C.p is fixed by induction 
assumption. Consider then the two following cases: 

• G T.p, C.q ^ C.p, S.q = dominated. In this case, every p's neighbor j 
satisfies C.p C.j V S.j = dominated forever. As a consequence, either S.p 
is already equal to Dominator or p switches S.p to Dominator in the next 
round and then S.p is fixed forever. Hence, S.p is fixed to Dominator in at 
most A X (A: + 1) + 1 rounds and the induction holds in this case. 

• 3g G r.p, C.q ^ C.p, S.q = Dominator. In this case, p increments cur.p 
until pointing out a neighbor j such that C.j ^ C.p A S.j = Dominator: p 
increments cur.p at most 6.p — 1 times. Once cur.p points out a neighbor j 
such that C.j C.p A S.j = Dominator, S.p is definitely set to dominated 
(because S.j = Dominator forever). So, in at most A additional rounds, S.p 



INRIA 



Communication Efficiency in Self- stabilizing Silent Protocols 



21 



is definitely set to dominated. Hence, the S^-variable of every process p such 
that 7l{p) = /c + 1 is fixed after at most A x (fc + 2) rounds and the induction 
holds for z = A: + 1 in this case. 

□ 

By Lemmas [3] and [H Protocol MIS converges from any configuration to the MIS 
predicate in at most (A + l)n + 2 rounds. Moreover, MIS is 1- efficient because 
when a process p executes an action in MIS., it only reads the S^-variable and the 
C-constant of its neighbor pointed out by cur.p. Hence, follows: 

Theorem 5 Protocol MIS (Figure\B\) is a 1- efficient protocol that stabilizes to the 
MIS predicate in any locally-identified network. 

The following theorem shows a lower bound on the number of processes that are 
eventually "1-stable" (ie., processes that eventually read the communication state 
of the same neighbor at each step). Figure [9] gives an example that matches the 
lower bound. 

Theorem 6 Protocol MIS (Figure\^) is 0-([ -^^y+1 J^ i)-gta6/e where Umax the 
length (number of edges) of the longest elementary path in the network. 

Proof. Let Cmax be the length (number of edges) of the longest elementary 
path in the network. Once stabilized, at most [^^ni^+i] processes in this path are 
Dominators, otherwise at least two Dominators are neighbors and the system is 
not stabilized. As a consequense, at least [ ^^^^^ J processes are dominated in a 
silent configuration and Protocol MIS is ()-{[ ^'^''^^'^ \, I)- stable. □ 

5.3 Maximal Matching 

We now consider the maximal matching problem. A matching of the network is a 
subset of edges in which no pair of edges has a common incident process. A matching 
M is maximal if no proper superset of M is also a matching. 

In maximal matching problem^ each process p computes 5.p local Boolean func- 
tions inMM[q].p (one for each neighbor q) that decide if the edge {p^q] is in the 
maximal matching. The maximal matching predicate is true if and only if the sub- 
set of edges {{p^q] G E^inMM[q].p \/ inMM[p\.q} is a maximal matching of the 
network. In any self-stabilizing maximal matching protocol, the legitimate configu- 
rations are those satisfying the maximal matching predicate. 



RR n° 6731 



22 



S. Devismes et al. 




Figure 9: Example that matches the lower bound (the Dominator are the black 
nodes; the white nodes are the dominated) 



We propose in Figure [TO] a 1- efficient protocol that stabilizes to the maxi- 
mal matching predicate. In the following we refer to this protocol as Protocol 
MATCHIAfG ' The proposed protocol working in arbitrary networks still assuming 
the (local) coloring on processes. 

Communication Variables: 

M.p G {true, false} 

PR.p G {0 . . . S.p} 

Communication Constant: 

C.p: color 

Internal Variable: 

cur.p G [1 . . . 6.p] 

Predicate: 

P Rmarried{p) = {PR.p = cur.p A PR. (cur.p) = p) 
Actions: 

{PR.p ^ {0, cur.p}) PR.p < 

(M.p / PRmarried{p)) M.p ^ 

{PR.p = OAPR.{cur.p)=p) PR.p ■ 

{PR.p = cur.p A PR.{cur.p) / p A {M. (cur.p) V C. (cur.p) -< C.p)) PR.p < 

(PR.p = 0A PR.(cur.p) = OAC.p^ C. (cur.p) A ^M. (cur.p)) PR.p < 

(PR.p = A (PR.(cur.p) / V C. (cur.p) ^ C.p V M. (cur.p))) cur.p < 



- cur.p 

PRmarried(p) 

- cur.p 

- 

- cur.p 

- (cur.p mod 6.p) + 1 



Figure 10: Protocol MATCHXMQ For any process p 



Protocol MATCHIAfQ derives from the protocol in [17], but with some adap- 
tations to get the 1- efficiency. As previously, each process p has the communication 
constant color C.p and uses the internal c^xr-pointer to designate the current neigh- 
bor from which it reads the communication variables. 
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The basic principle of the protocol is to create pairs of married neighboring 
processes, the edges linking such pairs being in the maximal matching. To that goal, 
every process p maintains the variable PR.p. Either PR.p points out a neighbor or 
is equal to 0. Two neighboring processes are married if and only if their Pi?- values 
point out to each other. A process that is not married is said unmarried. The 
predicate PRmarried{p) states if the process p is currently married, or not. Hence, 
for every process p and every j)'s neighbor inMM[q].p = (PRmarried{p)APR.p = 
q). If PR.p — 0, then this means that p is unmarried and does not currently try to 
get married. In this case, p is said free. If PR.p ^ 0, then p is either married or tries 
to get married with the neighbor pointed out by PR.p. Hence, the value of PR.p 
is not sufficient to allow all neighbors of p to determine its current status (married 
or unmarried). We use the Boolean variable M.p to let neighboring processes of p 
know if p is married or not. 

Using these variables, the protocol is composed of six actions (ordered from 
the highest to the lowest priority). Using these actions, each process p applies the 
following strategies: 

• ^ is only allowed to be (or try to get) married with the neighbor pointed out by 
cur.p. So, if PR.p ^ {0, cur.p} then PR.p is set to cur.p. Actually, if PR.p = q 
such that q ^ {0, cur.p}, then PR.p = q since the initial configuration. 

• p must inform its neighbors of its current status, i.e. married or unmarried, 
using M.p. To compute the value of M.p we use the predicate PRmarried{p): 
if M.p ^ PRmarried{p), then M.p is set to PRmarried{p). 

• If p is free {PR.p = 0) and p is pointed out by the Pi?-variable of a neighbor 
q, then this means that q proposes to p to get married. In this case, p accepts 
by setting PR.p to q (this rule allows to extend the matching). 

• p resets PR.p to when the neighbor pointed out by PR.p (i) is married with 
another process or (ii) has a lower color than p {w.r.t., ^). Condition (i) 
prevents p to wait for an already married process. Condition (ii) is used to 
break the initial cycles of Pi?- values. 

• If ^ is free, then it must try to get married. The two last rules achieve this 
goal, p tries to find a neighbor that is free and having a higher color than itself 
(to prevent cycle creation). So, p increments cur.p until finding an neighbor 
that matches this condition. In this latter case, p sets PR.p to cur.p in order 
to propose a marriage. 
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We now show the correctness of Protocol MATCHIAfQ (Theorem [7]) . We then 
show in Theorem El that Protocol MATCHlMQ is A)- stable. 

Lemma 5 In any silent configuration of Protocol AiATCTiXAfQ , every process is 
either free or married. 

Proof. Assume, by the contradiction, that there is a silent configuration of 
MATCHIAfQ where there is a process that is neither free nor married. Then, 
by definition, PR.po — pi such that pi (po is not free) and PR.pi ^ po (po is 
unmarried). Also, cur.po = pi otherwise po is enabled to set PR.po to cur.po, this 
contradicts the facts that the configuration is silent. Similarly, the fact that p is 
unmarried implies that M.po = false. 

As PR.pi Po and cur.po = we have M.pi — false and C.po C.pi 
otherwise po is enabled to set PR.po to and the configuration is not silent, a con- 
tradiction. In addition, M.pi = false implies that pi is unmarried. Also, pi cannot 
be free otherwise pi eventually modify PR.pi (in the worst case, pi increments 
cur.pi until cur.pi = po and then sets PR.pi to po). To sum up, pi is a neighbor of 
^0 such that C.po ^ C.pi and that is either free nor married. 

Repeating the same argument for pi as we just did for po, it follows that pi has 
a neighbor p2 such that C.pi ^ C.p2 and that is either free nor married, and so on. 

However, the sequence of processes po^ pi^ P2- • - cannot be extended indefinitely 
since each process must have a lower color than its preceding one. Hence, this 
contradicts the initial assumption. □ 

Lemma 6 Any silent configuration of Protocol MATCTHMQ satisfies the maximal 
matching predicate. 

Proof. We show this lemma in two steps: (z) First we show that, in a silent 
configuration, the set A of edges {p, q} such that {PRmarried{p) A PR.p = is a 
matching, {ii) Then, we show that this matching is a maximal. 

(z) Consider any process p. By Lemma [5l in a silent configuration p is either free 
or married. If p is free, then p is incident of no edge in A. If p is married, then 
p is incident of exactly one edge in A, i.e., the edge linking p and its neighbor 
pointed out by PR.p. Hence, in a silent configuration every process is incident 
of at most one edge in A, which proves that A is a matching. 

{ii) Assume, by the contradiction, that there is a silent configuration 7 where A 
is not maximal. Then, by Lemma O there is two neighbors p and q that are 
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free in 7. Following the two last actions of the protocol, at least one of them 
eventually modifies its Pi?- variable, this contradicts the fact that 7 is silent. 

□ 

Lemma 7 After the first round, every process p satisfies PR.p G {0, cur.p} forever. 

Proof. Let p be a process. 

First, if PR.p G {0, cur.p}^ then PR.p G {0, cur.p} forever because PR.p can ony 
be set to or cur.p and cur.p can be modified only if PR.p = 0. 

Assume then that PR.p ^ {0, cur.p}. In this case, the first action (the one with 
the highest priority) of the protocol is enabled at p. So, PR.p and cur.p cannot be 
modified before execute this action: the action is continuously enabled. Hence, p 
sets PR.p to cur.p in at most one round and then PR.p G {0, cur.p} holds forever. 

Hence, after the first round, every process p satisfies PR.p G {0, cur.p} forever. 

□ 

Lemma 8 Let A ^ II be a maximal connected subset of unmarried processes in 
some configuration after the first round. If \A\ > 2, then after at most 2A + 2 
rounds the size of A decreases by at least 2. 

Proof. Let S be the suffix of the computation that starts after the end of the 
first round. Let V{A) be the set of process p such that p ^ A and p has a neighbor 
A. 

First the size of A cannot increase because once married, a process remains 
married forever. Assume now, by the contradiction, that A does not decrease of at 
least 2 during 2A + 2 rounds in S. This implies that no two process of A get married 
during this period. 

Let be the prefix of S containing 2A + 2 rounds. 

We first show that after one round in S\ every process p satisfies: {p G 1(A)) ^ 
(M.p = true) A {p e A) ^ (M.p = false). First, by definition of A, if p G I (A), p 
is married. So, if M.p = true already holds at the beginning of the round, then it 
remains true forever. Otherwise, p is continuously enabled to set M.p to true using 
the second action of the protocol and, as this action is the enabled action of p with 
the highest priority (by Lemma El the first action of p is disabled), p executes it 
in at most one round and then M.p = true holds forever. If p is in A, then p is 
unmarried and, by contradiction assumption, p remains unmarried in S^. So, using 
a similar reasonning, in at most one round, M.p = false holds in S^. 
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We now show that after two rounds in S\ for every process if PR.p ^ 0, then 
PR.'p ^ holds until the end of S' . First, every process p that is enabled to set 
PR.p to (the fourth rule of the protocol) at the beginining of the third round in 
S' is continuously enabled because M and C are constant for every process and the 
neighbor q pointed out by cur.p never set PR.q to p (otherwise p becomes married, 
which contradicts the contradiction assumption). As the fourth action of p is the 
enabled action having the highest priority (remember that p must not execute its 
third action by contradiction assumption), p sets PR.p to in at most one round. 
Consider then the processes that sets PR.p to or that are disabled to execute 
the fourth action at the beginning of the round. These processes cannot be enabled 
again to execute the fourth action in S' because M and C are constant and a process 
p never points out using PR.p to a process q such that M.q V C.q C.p. Hence, 
after two rounds, for every process if PR.p ^ 0, then PR.p ^ holds until the 
end of S'. 

We now show that after A +2 rounds in S' ^ for every process p in A, we have either 
(1) PR.p = g G A or (2) PR.p = and every neighbor q ^ A satisfies PR.q G A. 
First, PR.p — cur.p by Lemma El Then, as p is never married, PR.{cur.p) ^ p. 
Finally, from the previous case, after two round in 5^ no process can execute the 
fourth action. Hence, from the guard of the fourth action, we can deduce that 
M.q — false and, as a consequence, q ^ A (see first part of the proof) which proves 
(1). We now show (2) by the contradiction. Assume then that after A + 2 rounds 
there is two neighboring processes p and q in A such that PR.p = and PR.q = 0. 
After 2 rounds in S', only the two last actions of the protocol can be executed in 

by p or q. Then, p and q executes the last action of the protocol at each round 
(as they are assumed to satisfy PR = after A + 2 rounds, they cannot execute 
the fifth action). Now, both p and q satisfy M = false and PR = 0. Also, either 
C.p ^ C.q or C.q ^ C.p. So, both p and q cannot execute the last action of the 
protocol A times, a contradiction. 

We now show that in at most 2A + 2 rounds, at least two neighboring processes 
in A get married. First, after A + 2 rounds in S\ there is some process p G A such 
that PR.p = and there exists a neighbor q such that PR.q = p otherwise there at 
least one process that is enabled to set its Pi?- variable to (to break the Pi?-cycle) , 
which contradicts the second part of the proof. As previously, p executes at least 
one of the two last actions of the protocol at each round. So, in at most A — 1 
rounds, p points out using cur.p a process such that PR.{cur.p) — p and then get 
married with the process pointed out by cur.p in at most one additionnal round, 
which contradicts the contradiction assumption. 
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Hence, before the end of S' at least two processes get married, which proves the 
lemma. □ 

Lemma 9 Starting from any configuration, any computation of Protocol MAT CTiZMQ 
reaches a silent configuration in at most (A + l)n + 2 rounds. 

Proof. First, the number of married processes cannot decrease. Then, after 
the first round and until there is a maximal matching in the system, the number of 
married processes increases by at least 2 every 2 A + 2 rounds by Lemma El Hence, 
there is a maximal matching into the networks after at most (A + l)n + l rounds. 
Once maximal matching is available in the network, one more round is necessary 
so that every married process p satisfies M.p — true and every ummarried process 
p satisfies PR.p — 0. Hence, starting from any initial configuration, the system 
reaches a silent configuration in at most (A + l)n + 2 rounds. □ 

By Lemmas [6] and [9l Protocol MATCTHMQ converges from any configuration to 
the maximal matching predicate. Moreover, AiATCTiXAfQ is 1- efficient because 
when a process p executes an action in Protocol AiATCHIAfG , it only reads the 
communication variables of its neighbor pointed out by cur.p. Hence, follows: 

Theorem 7 Protocol MATCHIAfG (Figure [W\) is a 1-efficient protocol that sta- 
bilizes to the maximal matching predicate in any locally-identified network. 

The following theorem shows a lower bound on the number of processes that are 
eventually "1-stable" (i.e., processes that eventually read the communication state 
of the same neighbor at each step). Figure [TT] gives an example that matches the 
lower bound. 

Theorem 8 Protocol MAT CHIN Q (Figure\M) is ()-{2\,^^'\, I) -stable where m. 

Proof. From [6J, we know that any maximal matching in a graph has a size at 
least [ ^A^i l edges. So, as a process belongs to at most one matched edge, we can 
conclude that at least 2 [2^^] processes are eventually matched. As a consequence. 
Protocol MATCnXMG is ^-[2\j^'\ , l)-stable. □ 

6 Concluding remarks 

We focused on improving communication efficiency of self-stabilizing protocols that 
eventually reach a global fixed point, and devised how much gain can be expected 
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Figure 11: Example that matches the lower bound (the matched edges are in bold): 
A = 4 and m = 14 

when implementing those protocols in a realistic model. Our results demonstrate the 
task difficulty, as most systematic improvements are impossible to get, yet also shows 
that some global improvement can be achieved over the least-overhead solutions 
known so far, the so-called local checking self-stabilizing protocols. 

While we demonstrated the effectiveness of our scheme to reduce communica- 
tion need on several local checking examples, the possibility of designing an efficient 
general transformer for protocols matching the local checking paradigm remains an 
open question. This transformer would allow to easily get more efficient commu- 
nication in the stabilized phase or in absence of faults, but the effectiveness of the 
transformed protocol in the stabilizing phase is yet to be known. 
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